In operations security, information technology (IT) users and administrators deal with the secure set-up of computer systems. The secure set-up of computer systems can concern upgrade and patch management of software to check that installed components include the latest security patches. The secure set-up of computer systems can also concern secure software configuration settings, to check, for example, whether a personal firewall has been deactivated or a virus signature list is updated in an automated fashion. The security domain “operations security” is relevant for both end-user computers and servers.
Current tools for operations security are mostly proprietary and focus on software of a particular vendor (e.g., central management of front-end virus scanners, upgrade and patch management of components). Slowly, proprietary solutions have begun to adapt to recently developed standards for endpoint security validation. These standards enable the creation of standardized checks, independent of specific vendors or products. A repository of standardized checks can be maintained by a sponsoring organization for a variety of products.
Check definitions (e.g., provided in extensible mark-up language (XML)) are created a-posteriori. Accordingly, a knowledgeable person creates a check definition for a given, already shipped product, based on the particular product knowledge of that person. Such a knowledgeable person can include a system or security administrator who is in charge of managing a certain landscape, and is required to reverse engineer the product. That is, the administrator would need to identify security-relevant configurations and their storage location (e.g., in registry entries, configuration files, environment variables). The knowledgeable person can also be a developer of the product vendor. In such a case, the person can typically access the required information more easily, but still does this manually.
In any case, administrator or developer, the creation of a comprehensive checklist of all security-relevant configuration settings is a time-consuming, laborious and erroneous process, particularly when considering complex industry or business solutions that include hundreds of single components. Consequently, operations security processes and technologies are not very effective and either result in undetected, exploitable security vulnerabilities or decrease of efficiency and total cost of ownership (TCO).